In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]---

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-612:33 advisory.

    * kernel: nvme: avoid double free special payload (CVE-2024-41073)
      * kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()     (CVE-2025-40252)
      * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
      * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
      * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)
      * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50261 advisory.

    - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39344515]  {CVE-2026-43284}
    - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344515]     {CVE-2026-43284}
    - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39327141]  {CVE-2025-54518}
    - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39250686]  {CVE-2026-31431}
    - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241228,39273722] {CVE-2026-31628}
    - net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847720]     {CVE-2025-68775}
    - ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649062] {CVE-2025-40135}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930868]     {CVE-2026-23059}
    - bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887702]     {CVE-2026-22994}
    - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887682]     {CVE-2026-22989}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970398] {CVE-2026-23173}
    - net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887601] {CVE-2025-71148}
    - scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798929] {CVE-2025-68741}
    - bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847684] {CVE-2025-68770}
    - perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847849]     {CVE-2025-68798}
    - scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798848]     {CVE-2025-68371}
    - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773579]     {CVE-2025-68259}
    - x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae) [Orabug: 38773165] {CVE-2025-68171}
    - virtio-net: fix received length check in big packets (Bui Quang Minh) [Orabug: 38737152]     {CVE-2025-40292}
    - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38641284]     {CVE-2025-38113}
    - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo) [Orabug: 38649173]     {CVE-2025-40157}
    - sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu) [Orabug: 38649042]     {CVE-2025-40129}
    - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() (Jinjie Ruan) [Orabug: 38641275]     {CVE-2024-53230}
    - cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() (Jinjie Ruan) [Orabug: 38641272]     {CVE-2024-53231}
    - vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592117]     {CVE-2025-40056}
    - crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401717]     {CVE-2025-39721}
    - vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592085] {CVE-2025-40051}
    - virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324330] {CVE-2025-38551}
    - gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401492] {CVE-2025-38735}
    - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson)     [Orabug: 38254140] {CVE-2025-38455}
    - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253871]     {CVE-2025-38385}
    - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094809]     {CVE-2025-38020}
    - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094794]     {CVE-2025-38015}
    - net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152903] {CVE-2025-38109}
    - bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175054] {CVE-2025-38246}
    - eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski) [Orabug: 37937451]     {CVE-2025-37873}
    - net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin) [Orabug: 37938078]     {CVE-2025-37888}
    - nfsd: fix possible badness in FREE_STATEID (Olga Kornievskaia) [Orabug: 37989102] {CVE-2024-50043}
    - devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski) [Orabug: 37828271] {CVE-2025-22017}
    - xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia) [Orabug: 37828202]     {CVE-2025-21997}
    - RDMA/mlx5: Fix the recovery flow of the UMR QP (Yishai Hadas) [Orabug: 37766306] {CVE-2025-21892}
    - misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors (Vimal Agrawal) [Orabug: 37678552]     {CVE-2024-58078}
    - net/sched: cls_api: fix error handling causing NULL dereference (Pierre Riteau) [Orabug: 37702083]     {CVE-2025-21857}
    - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (Shigeru Yoshida) [Orabug: 37766220]     {CVE-2025-21867}
    - net: xdp: Disallow attaching device-bound programs in generic mode (Toke Hoiland-Jorgensen) [Orabug:
    37650238] {CVE-2025-21808}
    - iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (Qasim Ijaz) [Orabug:
    37649891] {CVE-2025-21724}
    - xfrm: delete intermediate secpath entry in packet offload mode (Alexandre Cassen) [Orabug: 37649866]     {CVE-2025-21720}
    - gpiolib: Fix crash on error in gpiochip_get_ngpios() (Andy Shevchenko) [Orabug: 37650154]     {CVE-2025-21783}
    - scsi: mpi3mr: Fix possible crash when setting up bsg fails (Guixin Liu) [Orabug: 37649886]     {CVE-2025-21723}
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)     [Orabug: 39151165,39159089] {CVE-2026-23401}
    - scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 38976650,39130775]     {CVE-2026-23296}
    - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188477]     {CVE-2026-31411}
    - RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103109] {CVE-2026-23243}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:15883 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)

    * kernel: netfilter: nf_conncount: update last_gc only when GC has been performed (CVE-2026-23139)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:14339 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)

    * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-13577 advisory.

    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)     [RHEL-172187] {CVE-2026-31431}
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187]     {CVE-2026-23060}
    - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187]     {CVE-2026-31677}
    - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini)     [RHEL-153727] {CVE-2026-23401}
    - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot)     [RHEL-166921] {CVE-2025-68724}
    - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin)     [RHEL-166155] {CVE-2025-40252}
    - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13932 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191)

    * kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential     privilege escalation. (CVE-2025-71238)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:14230 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:14137 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (CVE-2025-37861)

    * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13936 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (CVE-2025-37861)

    * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:13577 advisory.

    * kernel: nvme: avoid double free special payload (CVE-2024-41073)

    * kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()     (CVE-2025-40252)

    * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

    * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:13578 advisory.

    * kernel: nvme: avoid double free special payload (CVE-2024-41073)

    * kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()     (CVE-2025-40252)

    * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

    * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:13578 advisory.

    * kernel: nvme: avoid double free special payload (CVE-2024-41073)
      * kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()     (CVE-2025-40252)
      * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
      * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
      * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)
      * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:13577 advisory.

    * kernel: nvme: avoid double free special payload (CVE-2024-41073)
      * kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()     (CVE-2025-40252)
      * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
      * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
      * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)
      * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1646 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    landlock: Fix handling of disconnected directories (CVE-2025-68736)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/fpsimd: signal: Fix restoration of SVE context (CVE-2026-23102)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: tegra210-quad: Protect curr_xfer check in IRQ handler (CVE-2026-23207)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (CVE-2026-23401)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (CVE-2026-31406)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (CVE-2026-31413)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() (CVE-2026-31426)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (CVE-2026-31427)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (CVE-2026-31428)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix leak of kobject name for sub-group space_info (CVE-2026-31434)

    In the Linux kernel, the following vulnerability has been resolved:

    netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (CVE-2026-31438)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in update_super_work when racing with umount (CVE-2026-31446)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: reject mount if bigalloc with s_first_data_block != 0 (CVE-2026-31447)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid infinite loops caused by residual data (CVE-2026-31448)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: validate p_idx bounds in ext4_ext_correct_indexes (CVE-2026-31449)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio (CVE-2026-31451)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: convert inline data to extents when truncate exceeds inline size (CVE-2026-31452)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: avoid dereferencing log items after push callbacks (CVE-2026-31453)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: save ailp before dropping the AIL lock in push callbacks (CVE-2026-31454)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: stop reclaim before pushing AIL during unmount (CVE-2026-31455)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] (CVE-2026-31458)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: add GFP_NOIO in the bio completion if needed (CVE-2026-31467)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (CVE-2026-31469)

    In the Linux kernel, the following vulnerability has been resolved:

    virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (CVE-2026-31470)

    In the Linux kernel, the following vulnerability has been resolved:

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (CVE-2026-31473)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix potential deadlock in cpu hotplug with osnoise (CVE-2026-31480)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: use generic driver_override infrastructure (CVE-2026-31487)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/irdma: Initialize free_qp completion before using it (CVE-2026-31492)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: use netlink policy range checks (CVE-2026-31495)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc (CVE-2026-31496)

    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports (CVE-2026-31502)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix fanout UAF in packet_release() via NETDEV_UP race (CVE-2026-31504)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: set fileio bio failed in short read case (CVE-2026-31514)

    In the Linux kernel, the following vulnerability has been resolved:

    af_key: validate families in pfkey_send_migrate() (CVE-2026-31515)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: prevent policy_hthresh.work from racing with netns teardown (CVE-2026-31516)

    In the Linux kernel, the following vulnerability has been resolved:

    esp: fix skb leak with espintcp and async crypto (CVE-2026-31518)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (CVE-2026-31519)

    In the Linux kernel, the following vulnerability has been resolved:

    module: Fix kernel panic when a symbol st_shndx is out of bounds (CVE-2026-31521)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: ensure we're polling a polled queue (CVE-2026-31523)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: avoid memory leak in asus_report_fixup() (CVE-2026-31524)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (CVE-2026-31525)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: platform: use generic driver_override infrastructure (CVE-2026-31527)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Make sure to use pmu_ctx->pmu for groups (CVE-2026-31528)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Require sys_futex_requeue() to have identical flags (CVE-2026-31554)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Clear stale exiting pointer in futex_lock_pi() retry path (CVE-2026-31555)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (CVE-2026-31561)

    In the Linux kernel, the following vulnerability has been resolved:

    can: gw: fix OOB heap access in cgw_csum_crc8_rel() (CVE-2026-31570)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13577 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nvme: avoid double free special payload (CVE-2024-41073)

    * kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()     (CVE-2025-40252)

    * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

    * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13578 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: nvme: avoid double free special payload (CVE-2024-41073)

    * kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()     (CVE-2025-40252)

    * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

    * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table     entry handling (CVE-2026-23401)

    * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4561 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4561-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 02, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.170-1~deb11u1     CVE ID         : CVE-2023-53228 CVE-2023-53510 CVE-2023-53545 CVE-2024-47736                      CVE-2024-47809 CVE-2024-49998 CVE-2024-50298 CVE-2024-56719                      CVE-2025-21676 CVE-2025-21682 CVE-2025-37945 CVE-2025-37980                      CVE-2025-38105 CVE-2025-38162 CVE-2025-38192 CVE-2025-38250                      CVE-2025-38303 CVE-2025-38436 CVE-2025-38626 CVE-2025-38659                      CVE-2025-38704 CVE-2025-39748 CVE-2025-39764 CVE-2025-39863                      CVE-2025-40005 CVE-2025-40016 CVE-2025-40135 CVE-2025-40219                      CVE-2025-40242 CVE-2025-40261 CVE-2025-40358 CVE-2025-68206                      CVE-2025-68239 CVE-2025-68265 CVE-2025-71067 CVE-2025-71161                      CVE-2025-71221 CVE-2025-71265 CVE-2025-71266 CVE-2025-71267                      CVE-2025-71269 CVE-2026-23100 CVE-2026-23113 CVE-2026-23141                      CVE-2026-23154 CVE-2026-23157 CVE-2026-23204 CVE-2026-23227                      CVE-2026-23231 CVE-2026-23242 CVE-2026-23243 CVE-2026-23245                      CVE-2026-23253 CVE-2026-23270 CVE-2026-23271 CVE-2026-23273                      CVE-2026-23274 CVE-2026-23277 CVE-2026-23279 CVE-2026-23281                      CVE-2026-23284 CVE-2026-23286 CVE-2026-23287 CVE-2026-23289                      CVE-2026-23290 CVE-2026-23291 CVE-2026-23292 CVE-2026-23293                      CVE-2026-23296 CVE-2026-23298 CVE-2026-23300 CVE-2026-23303                      CVE-2026-23304 CVE-2026-23306 CVE-2026-23307 CVE-2026-23312                      CVE-2026-23315 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319                      CVE-2026-23321 CVE-2026-23324 CVE-2026-23335 CVE-2026-23336                      CVE-2026-23339 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23356 CVE-2026-23357 CVE-2026-23359                      CVE-2026-23362 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367                      CVE-2026-23368 CVE-2026-23370 CVE-2026-23372 CVE-2026-23378                      CVE-2026-23379 CVE-2026-23381 CVE-2026-23382 CVE-2026-23388                      CVE-2026-23391 CVE-2026-23392 CVE-2026-23395 CVE-2026-23396                      CVE-2026-23397 CVE-2026-23398 CVE-2026-23401 CVE-2026-23414                      CVE-2026-23420 CVE-2026-23422 CVE-2026-23426 CVE-2026-23428                      CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23446                      CVE-2026-23449 CVE-2026-23450 CVE-2026-23452 CVE-2026-23454                      CVE-2026-23455 CVE-2026-23456 CVE-2026-23457 CVE-2026-23458                      CVE-2026-23460 CVE-2026-23462 CVE-2026-23463 CVE-2026-23474                      CVE-2026-23475 CVE-2026-31389 CVE-2026-31391 CVE-2026-31392                      CVE-2026-31393 CVE-2026-31396 CVE-2026-31399 CVE-2026-31400                      CVE-2026-31402 CVE-2026-31403 CVE-2026-31405 CVE-2026-31408                      CVE-2026-31409 CVE-2026-31411 CVE-2026-31412 CVE-2026-31414                      CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418                      CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424                      CVE-2026-31425 CVE-2026-31426 CVE-2026-31427 CVE-2026-31428                      CVE-2026-31431 CVE-2026-31433 CVE-2026-31434 CVE-2026-31441                      CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31450                      CVE-2026-31452 CVE-2026-31453 CVE-2026-31454 CVE-2026-31455                      CVE-2026-31464 CVE-2026-31466 CVE-2026-31467 CVE-2026-31469                      CVE-2026-31473 CVE-2026-31476 CVE-2026-31477 CVE-2026-31478                      CVE-2026-31480 CVE-2026-31483 CVE-2026-31485 CVE-2026-31492                      CVE-2026-31494 CVE-2026-31495 CVE-2026-31496 CVE-2026-31497                      CVE-2026-31498 CVE-2026-31503 CVE-2026-31504 CVE-2026-31507                      CVE-2026-31508 CVE-2026-31509 CVE-2026-31510 CVE-2026-31512                      CVE-2026-31515 CVE-2026-31518 CVE-2026-31519 CVE-2026-31520                      CVE-2026-31521 CVE-2026-31522 CVE-2026-31523 CVE-2026-31524                      CVE-2026-31533 CVE-2026-31540 CVE-2026-31545 CVE-2026-31546                      CVE-2026-31548 CVE-2026-31549 CVE-2026-31550 CVE-2026-31551                      CVE-2026-31552 CVE-2026-31555 CVE-2026-31563 CVE-2026-31565                      CVE-2026-31566 CVE-2026-31570 CVE-2026-31628 CVE-2026-31634                      CVE-2026-31649 CVE-2026-31651 CVE-2026-31656 CVE-2026-31657                      CVE-2026-31658 CVE-2026-31659 CVE-2026-31660 CVE-2026-31661                      CVE-2026-31662 CVE-2026-31664 CVE-2026-31665 CVE-2026-31667                      CVE-2026-31668 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31674 CVE-2026-31678 CVE-2026-31679                      CVE-2026-31680 CVE-2026-31682 CVE-2026-31683 CVE-2026-31689                      CVE-2026-31695 CVE-2026-31720 CVE-2026-31721 CVE-2026-31726                      CVE-2026-31728 CVE-2026-31737 CVE-2026-31738 CVE-2026-31747                      CVE-2026-31748 CVE-2026-31749 CVE-2026-31751 CVE-2026-31752                      CVE-2026-31754 CVE-2026-31755 CVE-2026-31756 CVE-2026-31758                      CVE-2026-31759 CVE-2026-31761 CVE-2026-31762 CVE-2026-31763                      CVE-2026-31768 CVE-2026-31770 CVE-2026-31773 CVE-2026-31776                      CVE-2026-31778 CVE-2026-31779 CVE-2026-31780 CVE-2026-31781                      CVE-2026-31786 CVE-2026-31787 CVE-2026-31788 CVE-2026-43011                      CVE-2026-43013 CVE-2026-43014 CVE-2026-43015 CVE-2026-43017                      CVE-2026-43018 CVE-2026-43020 CVE-2026-43023 CVE-2026-43024                      CVE-2026-43025 CVE-2026-43026 CVE-2026-43027 CVE-2026-43028                      CVE-2026-43030 CVE-2026-43032 CVE-2026-43033 CVE-2026-43035                      CVE-2026-43037 CVE-2026-43038 CVE-2026-43040 CVE-2026-43041                      CVE-2026-43043 CVE-2026-43046 CVE-2026-43047 CVE-2026-43050                      CVE-2026-43051 CVE-2026-43054 CVE-2026-43057

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.170-1~deb11u1.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6243 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6243-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 01, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2023-53228 CVE-2023-53510 CVE-2023-53545 CVE-2024-47736                      CVE-2024-47809 CVE-2024-49998 CVE-2024-50298 CVE-2024-56719                      CVE-2025-21676 CVE-2025-21682 CVE-2025-37945 CVE-2025-37980                      CVE-2025-38105 CVE-2025-38162 CVE-2025-38192 CVE-2025-38250                      CVE-2025-38303 CVE-2025-38436 CVE-2025-38626 CVE-2025-38659                      CVE-2025-38704 CVE-2025-39748 CVE-2025-39764 CVE-2025-39863                      CVE-2025-40005 CVE-2025-40016 CVE-2025-40135 CVE-2025-40219                      CVE-2025-40242 CVE-2025-40261 CVE-2025-40358 CVE-2025-68206                      CVE-2025-68239 CVE-2025-68265 CVE-2025-71067 CVE-2025-71161                      CVE-2025-71221 CVE-2025-71265 CVE-2025-71266 CVE-2025-71267                      CVE-2025-71269 CVE-2026-23100 CVE-2026-23113 CVE-2026-23141                      CVE-2026-23154 CVE-2026-23157 CVE-2026-23204 CVE-2026-23227                      CVE-2026-23231 CVE-2026-23242 CVE-2026-23243 CVE-2026-23245                      CVE-2026-23253 CVE-2026-23270 CVE-2026-23271 CVE-2026-23273                      CVE-2026-23274 CVE-2026-23277 CVE-2026-23279 CVE-2026-23281                      CVE-2026-23284 CVE-2026-23286 CVE-2026-23287 CVE-2026-23289                      CVE-2026-23290 CVE-2026-23291 CVE-2026-23292 CVE-2026-23293                      CVE-2026-23296 CVE-2026-23298 CVE-2026-23300 CVE-2026-23303                      CVE-2026-23304 CVE-2026-23306 CVE-2026-23307 CVE-2026-23312                      CVE-2026-23315 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319                      CVE-2026-23321 CVE-2026-23324 CVE-2026-23335 CVE-2026-23336                      CVE-2026-23339 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23356 CVE-2026-23357 CVE-2026-23359                      CVE-2026-23362 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367                      CVE-2026-23368 CVE-2026-23370 CVE-2026-23372 CVE-2026-23378                      CVE-2026-23379 CVE-2026-23381 CVE-2026-23382 CVE-2026-23388                      CVE-2026-23391 CVE-2026-23392 CVE-2026-23395 CVE-2026-23396                      CVE-2026-23397 CVE-2026-23398 CVE-2026-23401 CVE-2026-23414                      CVE-2026-23420 CVE-2026-23422 CVE-2026-23426 CVE-2026-23428                      CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23446                      CVE-2026-23449 CVE-2026-23450 CVE-2026-23452 CVE-2026-23454                      CVE-2026-23455 CVE-2026-23456 CVE-2026-23457 CVE-2026-23458                      CVE-2026-23460 CVE-2026-23462 CVE-2026-23463 CVE-2026-23474                      CVE-2026-23475 CVE-2026-31389 CVE-2026-31391 CVE-2026-31392                      CVE-2026-31393 CVE-2026-31396 CVE-2026-31399 CVE-2026-31400                      CVE-2026-31402 CVE-2026-31403 CVE-2026-31405 CVE-2026-31408                      CVE-2026-31409 CVE-2026-31411 CVE-2026-31412 CVE-2026-31414                      CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418                      CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424                      CVE-2026-31425 CVE-2026-31426 CVE-2026-31427 CVE-2026-31428                      CVE-2026-31431 CVE-2026-31433 CVE-2026-31434 CVE-2026-31441                      CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31450                      CVE-2026-31452 CVE-2026-31453 CVE-2026-31454 CVE-2026-31455                      CVE-2026-31464 CVE-2026-31466 CVE-2026-31467 CVE-2026-31469                      CVE-2026-31473 CVE-2026-31476 CVE-2026-31477 CVE-2026-31478                      CVE-2026-31480 CVE-2026-31483 CVE-2026-31485 CVE-2026-31492                      CVE-2026-31494 CVE-2026-31495 CVE-2026-31496 CVE-2026-31497                      CVE-2026-31498 CVE-2026-31503 CVE-2026-31504 CVE-2026-31507                      CVE-2026-31508 CVE-2026-31509 CVE-2026-31510 CVE-2026-31512                      CVE-2026-31515 CVE-2026-31518 CVE-2026-31519 CVE-2026-31520                      CVE-2026-31521 CVE-2026-31522 CVE-2026-31523 CVE-2026-31524                      CVE-2026-31533 CVE-2026-31540 CVE-2026-31545 CVE-2026-31546                      CVE-2026-31548 CVE-2026-31549 CVE-2026-31550 CVE-2026-31551                      CVE-2026-31552 CVE-2026-31555 CVE-2026-31563 CVE-2026-31565                      CVE-2026-31566 CVE-2026-31570 CVE-2026-31628 CVE-2026-31634                      CVE-2026-31649 CVE-2026-31651 CVE-2026-31656 CVE-2026-31657                      CVE-2026-31658 CVE-2026-31659 CVE-2026-31660 CVE-2026-31661                      CVE-2026-31662 CVE-2026-31664 CVE-2026-31665 CVE-2026-31667                      CVE-2026-31668 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31674 CVE-2026-31678 CVE-2026-31679                      CVE-2026-31680 CVE-2026-31682 CVE-2026-31683 CVE-2026-31689                      CVE-2026-31695 CVE-2026-31720 CVE-2026-31721 CVE-2026-31726                      CVE-2026-31728 CVE-2026-31737 CVE-2026-31738 CVE-2026-31747                      CVE-2026-31748 CVE-2026-31749 CVE-2026-31751 CVE-2026-31752                      CVE-2026-31754 CVE-2026-31755 CVE-2026-31756 CVE-2026-31758                      CVE-2026-31759 CVE-2026-31761 CVE-2026-31762 CVE-2026-31763                      CVE-2026-31768 CVE-2026-31770 CVE-2026-31773 CVE-2026-31776                      CVE-2026-31778 CVE-2026-31779 CVE-2026-31780 CVE-2026-31781                      CVE-2026-31786 CVE-2026-31787 CVE-2026-31788 CVE-2026-43011                      CVE-2026-43013 CVE-2026-43014 CVE-2026-43015 CVE-2026-43017                      CVE-2026-43018 CVE-2026-43020 CVE-2026-43023 CVE-2026-43024                      CVE-2026-43025 CVE-2026-43026 CVE-2026-43027 CVE-2026-43028                      CVE-2026-43030 CVE-2026-43032 CVE-2026-43033 CVE-2026-43035                      CVE-2026-43037 CVE-2026-43038 CVE-2026-43040 CVE-2026-43041                      CVE-2026-43043 CVE-2026-43046 CVE-2026-43047 CVE-2026-43050                      CVE-2026-43051 CVE-2026-43054 CVE-2026-43057

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.170-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6238 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6238-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     April 30, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2024-14027 CVE-2025-21709 CVE-2025-22116 CVE-2025-22117                      CVE-2025-38426 CVE-2025-38627 CVE-2025-39764 CVE-2025-40005                      CVE-2025-40135 CVE-2025-40147 CVE-2025-40150 CVE-2025-40219                      CVE-2025-68175 CVE-2025-68239 CVE-2025-68334 CVE-2025-68736                      CVE-2025-71152 CVE-2025-71161 CVE-2025-71221 CVE-2025-71239                      CVE-2025-71265 CVE-2025-71266 CVE-2025-71267 CVE-2025-71269                      CVE-2026-22981 CVE-2026-22985 CVE-2026-22986 CVE-2026-22993                      CVE-2026-23004 CVE-2026-23066 CVE-2026-23070 CVE-2026-23104                      CVE-2026-23138 CVE-2026-23157 CVE-2026-23207 CVE-2026-23210                      CVE-2026-23226 CVE-2026-23227 CVE-2026-23231 CVE-2026-23239                      CVE-2026-23240 CVE-2026-23242 CVE-2026-23243 CVE-2026-23244                      CVE-2026-23245 CVE-2026-23246 CVE-2026-23249 CVE-2026-23250                      CVE-2026-23251 CVE-2026-23252 CVE-2026-23253 CVE-2026-23255                      CVE-2026-23270 CVE-2026-23271 CVE-2026-23273 CVE-2026-23274                      CVE-2026-23276 CVE-2026-23277 CVE-2026-23278 CVE-2026-23279                      CVE-2026-23281 CVE-2026-23284 CVE-2026-23285 CVE-2026-23286                      CVE-2026-23287 CVE-2026-23289 CVE-2026-23290 CVE-2026-23291                      CVE-2026-23292 CVE-2026-23293 CVE-2026-23296 CVE-2026-23297                      CVE-2026-23298 CVE-2026-23300 CVE-2026-23302 CVE-2026-23303                      CVE-2026-23304 CVE-2026-23306 CVE-2026-23307 CVE-2026-23308                      CVE-2026-23310 CVE-2026-23312 CVE-2026-23313 CVE-2026-23315                      CVE-2026-23316 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319                      CVE-2026-23321 CVE-2026-23324 CVE-2026-23325 CVE-2026-23330                      CVE-2026-23334 CVE-2026-23335 CVE-2026-23336 CVE-2026-23339                      CVE-2026-23340 CVE-2026-23343 CVE-2026-23347 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23354 CVE-2026-23356 CVE-2026-23357                      CVE-2026-23359 CVE-2026-23360 CVE-2026-23361 CVE-2026-23362                      CVE-2026-23363 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367                      CVE-2026-23368 CVE-2026-23369 CVE-2026-23370 CVE-2026-23372                      CVE-2026-23373 CVE-2026-23374 CVE-2026-23375 CVE-2026-23378                      CVE-2026-23379 CVE-2026-23380 CVE-2026-23381 CVE-2026-23382                      CVE-2026-23383 CVE-2026-23386 CVE-2026-23387 CVE-2026-23388                      CVE-2026-23389 CVE-2026-23391 CVE-2026-23392 CVE-2026-23393                      CVE-2026-23395 CVE-2026-23396 CVE-2026-23397 CVE-2026-23398                      CVE-2026-23399 CVE-2026-23401 CVE-2026-23412 CVE-2026-23413                      CVE-2026-23414 CVE-2026-23417 CVE-2026-23419 CVE-2026-23420                      CVE-2026-23422 CVE-2026-23426 CVE-2026-23427 CVE-2026-23428                      CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23440                      CVE-2026-23441 CVE-2026-23442 CVE-2026-23444 CVE-2026-23445                      CVE-2026-23446 CVE-2026-23447 CVE-2026-23448 CVE-2026-23449                      CVE-2026-23450 CVE-2026-23452 CVE-2026-23454 CVE-2026-23455                      CVE-2026-23456 CVE-2026-23457 CVE-2026-23458 CVE-2026-23460                      CVE-2026-23461 CVE-2026-23462 CVE-2026-23463 CVE-2026-23464                      CVE-2026-23465 CVE-2026-23466 CVE-2026-23470 CVE-2026-23474                      CVE-2026-23475 CVE-2026-31389 CVE-2026-31391 CVE-2026-31392                      CVE-2026-31393 CVE-2026-31394 CVE-2026-31396 CVE-2026-31399                      CVE-2026-31400 CVE-2026-31401 CVE-2026-31402 CVE-2026-31403                      CVE-2026-31405 CVE-2026-31406 CVE-2026-31407 CVE-2026-31408                      CVE-2026-31409 CVE-2026-31410 CVE-2026-31411 CVE-2026-31412                      CVE-2026-31414 CVE-2026-31415 CVE-2026-31416 CVE-2026-31417                      CVE-2026-31418 CVE-2026-31421 CVE-2026-31422 CVE-2026-31423                      CVE-2026-31424 CVE-2026-31425 CVE-2026-31426 CVE-2026-31427                      CVE-2026-31428 CVE-2026-31429 CVE-2026-31430 CVE-2026-31431                      CVE-2026-31432 CVE-2026-31433 CVE-2026-31434 CVE-2026-31436                      CVE-2026-31438 CVE-2026-31439 CVE-2026-31440 CVE-2026-31441                      CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31449                      CVE-2026-31450 CVE-2026-31451 CVE-2026-31452 CVE-2026-31453                      CVE-2026-31454 CVE-2026-31455 CVE-2026-31458 CVE-2026-31462                      CVE-2026-31464 CVE-2026-31466 CVE-2026-31467 CVE-2026-31469                      CVE-2026-31470 CVE-2026-31473 CVE-2026-31474 CVE-2026-31476                      CVE-2026-31477 CVE-2026-31478 CVE-2026-31479 CVE-2026-31480                      CVE-2026-31482 CVE-2026-31483 CVE-2026-31485 CVE-2026-31487                      CVE-2026-31488 CVE-2026-31489 CVE-2026-31492 CVE-2026-31494                      CVE-2026-31495 CVE-2026-31496 CVE-2026-31497 CVE-2026-31498                      CVE-2026-31500 CVE-2026-31502 CVE-2026-31503 CVE-2026-31504                      CVE-2026-31505 CVE-2026-31506 CVE-2026-31507 CVE-2026-31508                      CVE-2026-31509 CVE-2026-31510 CVE-2026-31511 CVE-2026-31512                      CVE-2026-31515 CVE-2026-31516 CVE-2026-31518 CVE-2026-31519                      CVE-2026-31520 CVE-2026-31521 CVE-2026-31522 CVE-2026-31523                      CVE-2026-31524 CVE-2026-31525 CVE-2026-31527 CVE-2026-31528                      CVE-2026-31530 CVE-2026-31531 CVE-2026-31532 CVE-2026-31533                      CVE-2026-31540 CVE-2026-31542 CVE-2026-31545 CVE-2026-31546                      CVE-2026-31548 CVE-2026-31549 CVE-2026-31550 CVE-2026-31551                      CVE-2026-31552 CVE-2026-31554 CVE-2026-31555 CVE-2026-31556                      CVE-2026-31557 CVE-2026-31558 CVE-2026-31559 CVE-2026-31561                      CVE-2026-31563 CVE-2026-31565 CVE-2026-31566 CVE-2026-31570                      CVE-2026-31575 CVE-2026-31576 CVE-2026-31577 CVE-2026-31578                      CVE-2026-31580 CVE-2026-31581 CVE-2026-31582 CVE-2026-31583                      CVE-2026-31584 CVE-2026-31585 CVE-2026-31586 CVE-2026-31587                      CVE-2026-31588 CVE-2026-31590 CVE-2026-31593 CVE-2026-31594                      CVE-2026-31595 CVE-2026-31596 CVE-2026-31597 CVE-2026-31598                      CVE-2026-31599 CVE-2026-31602 CVE-2026-31603 CVE-2026-31604                      CVE-2026-31605 CVE-2026-31606 CVE-2026-31607 CVE-2026-31610                      CVE-2026-31611 CVE-2026-31612 CVE-2026-31614 CVE-2026-31615                      CVE-2026-31616 CVE-2026-31617 CVE-2026-31618 CVE-2026-31619                      CVE-2026-31622 CVE-2026-31623 CVE-2026-31624 CVE-2026-31625                      CVE-2026-31626 CVE-2026-31627 CVE-2026-31628 CVE-2026-31629                      CVE-2026-31634 CVE-2026-31637 CVE-2026-31638 CVE-2026-31639                      CVE-2026-31642 CVE-2026-31644 CVE-2026-31645 CVE-2026-31646                      CVE-2026-31647 CVE-2026-31648 CVE-2026-31649 CVE-2026-31651                      CVE-2026-31655 CVE-2026-31656 CVE-2026-31657 CVE-2026-31658                      CVE-2026-31659 CVE-2026-31660 CVE-2026-31661 CVE-2026-31662                      CVE-2026-31664 CVE-2026-31665 CVE-2026-31666 CVE-2026-31667                      CVE-2026-31668 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31673 CVE-2026-31674 CVE-2026-31675                      CVE-2026-31676 CVE-2026-31677 CVE-2026-31678 CVE-2026-31679                      CVE-2026-31680 CVE-2026-31681 CVE-2026-31682 CVE-2026-31683                      CVE-2026-31684 CVE-2026-31685 CVE-2026-31686 CVE-2026-31689                      CVE-2026-31693 CVE-2026-31786 CVE-2026-31787 CVE-2026-31788

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.85-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50232 advisory.

    - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
    - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]     {CVE-2026-23004}
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]     {CVE-2026-23231}
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)     [Orabug: 39153394]  {CVE-2026-23401}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated     MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit     a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to     a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g.
    if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest     hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE.
    ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at     mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass     CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT     Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP:
    0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm]     ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620     [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]     kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730     entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]---     (CVE-2026-23401)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-50170 advisory.

    [6.12.0-200.74.27.1]
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)     [Orabug: 39071315]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-50171 advisory.

    - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet)  [Orabug: 39057366]     {CVE-2026-23209}
    - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano)     [Orabug: 39057346]  {CVE-2026-23111}
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970594]     {CVE-2026-23202}
    - sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree) [Orabug: 37855346]     {CVE-2025-37860}
    - wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 39004275]     {CVE-2025-22119}
    - wifi: cfg80211: cancel wiphy_work before freeing wiphy (Miri Korenblit) [Orabug: 39004414]     {CVE-2025-21979}
    - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 39004242]     {CVE-2025-38007}
    - usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649206]     {CVE-2025-40164}
    - NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158712]     {CVE-2025-38232}
    - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094997] {CVE-2025-38057}
    - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)     [Orabug: 38773375] {CVE-2025-68211}
    - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930799]     {CVE-2025-71197}
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931015]     {CVE-2026-23087}
    - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug:
    38649138] {CVE-2025-40149}
    - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970353] {CVE-2026-23164}
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970605]     {CVE-2026-23146}
    - bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335081] {CVE-2025-38591}
    - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798882]     {CVE-2025-68725}
    - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931067]     {CVE-2026-23097}
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931121]     {CVE-2026-23108}
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug:
    38930883] {CVE-2026-23061}
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930860]     {CVE-2026-23058}
    - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931002]     {CVE-2026-23085}
    - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931041] {CVE-2026-23091}
    - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930941]     {CVE-2026-23073}
    - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970255] {CVE-2026-23133}
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931030]     {CVE-2026-23089}
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930967]     {CVE-2026-23076}
    - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931092]     {CVE-2026-23101}
    - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970200]     {CVE-2026-23119}
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930993]     {CVE-2026-23084}
    - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970223] {CVE-2026-23124}
    - mISDN: annotate data-race around dev->work (Eric Dumazet) [Orabug: 38970211] {CVE-2026-23121}
    - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930931]     {CVE-2026-23071}
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug:
    38930875] {CVE-2026-23060}
    - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi     Salim) [Orabug: 38931111] {CVE-2026-23105}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930949]     {CVE-2026-23074}
    - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931103] {CVE-2026-23103}
    - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970203] {CVE-2026-23120}
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970226]     {CVE-2026-23125}
    - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931080] {CVE-2026-23099}
    - Fix memory leak in posix_clock_open() (Linus Torvalds) [Orabug: 39004188] {CVE-2024-26655}
    - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug:
    38930779] {CVE-2025-71194}
    - dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914728] {CVE-2025-71190}
    - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug:
    38930830] {CVE-2026-23049}
    - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970601] {CVE-2026-23145}
    - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts     (Tetsuo Handa) [Orabug: 38887710] {CVE-2026-22997}
    - net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887718]     {CVE-2026-22999}
    - ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887758] {CVE-2026-23011}
    - macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887730] {CVE-2026-23001}
    - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887738]     {CVE-2026-23003}
    - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887714]     {CVE-2026-22998}
    - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914816]     {CVE-2026-23038}
    - can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug:
    38914675] {CVE-2025-71182}
    - nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887659] {CVE-2026-22980}
    - arp: do not assume dev_hard_header() does not change skb->head (Eric Dumazet) [Orabug: 39004363]     {CVE-2026-22988}
    - net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914761]     {CVE-2026-23021}
    - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei)     [Orabug: 38872325] {CVE-2026-22976}
    - net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877947]     {CVE-2026-22977}
    - netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera)     [Orabug: 38970278] {CVE-2026-23139}
    - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin) [Orabug: 37844521]     {CVE-2025-22121}
    - libceph: make calc_target() set t->paused, not just clear it (Ilya Dryomov) [Orabug: 38930821]     {CVE-2026-23047}
    - libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887697]     {CVE-2026-22992}
    - libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887691]     {CVE-2026-22991}
    - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887685]     {CVE-2026-22990}
    - libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887673]     {CVE-2026-22984}
    - wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887650] {CVE-2026-22978}
    - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914755]     {CVE-2026-23020}
    - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (Su Hui) [Orabug: 39004163]     {CVE-2024-40928}
    - ext4: filesystems without casefold feature cannot be mounted with siphash (Lizhi Xu) [Orabug: 37206152]     {CVE-2024-49968}
    - ipv4: Fix uninit-value access in __ip_make_skb() (Shigeru Yoshida) [Orabug: 36683410] {CVE-2024-36927}
    - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Shigeru Yoshida) [Orabug: 36683284]     {CVE-2024-36903}
    - HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334903] {CVE-2025-38556}
    - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (Sean Christopherson) [Orabug: 37116451]     {CVE-2024-46830}
    - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152994]     {CVE-2025-38129}
    - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug:
    37844500] {CVE-2025-22111}
    - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852361]     {CVE-2025-71127}
    - NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847872] {CVE-2025-68803}
    - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers)     [Orabug: 38852341] {CVE-2025-71120}
    - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852312]     {CVE-2025-71113}
    - svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847976] {CVE-2025-71068}
    - tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848017] {CVE-2025-71077}
    - usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773636]     {CVE-2025-68282}
    - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio) [Orabug: 37844150]     {CVE-2025-22022}
    - drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin) [Orabug: 38643537] {CVE-2025-40110}
    - RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem (Zhu Yanjun) [Orabug:
    38094814] {CVE-2025-38022}
    - drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848052] {CVE-2025-71083}
    - e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848099] {CVE-2025-71093}
    - RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848058]     {CVE-2025-71084}
    - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848117]     {CVE-2025-71096}
    - RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852379] {CVE-2025-71133}
    - ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug:
    38848125] {CVE-2025-71097}
    - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug:
    38848061] {CVE-2025-71085}
    - net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848107] {CVE-2025-71094}
    - smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852376] {CVE-2025-71132}
    - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887620]     {CVE-2025-71154}
    - team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug:
    38848088] {CVE-2025-71091}
    - ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848131] {CVE-2025-71098}
    - Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug:
    38848044] {CVE-2025-71082}
    - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852370]     {CVE-2025-71131}
    - iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848073] {CVE-2025-71087}
    - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852300]     {CVE-2025-71111}
    - fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug:
    38847800] {CVE-2025-68788}
    - tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852355] {CVE-2025-71125}
    - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug:
    38852273] {CVE-2025-71104}
    - libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852325]     {CVE-2025-71116}
    - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847688] {CVE-2025-68771}
    - scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847770]     {CVE-2025-68782}
    - scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848009]     {CVE-2025-71075}
    - scsi: Revert 'scsi: qla2xxx: Perform lockless command completion in abort path' (Tony Battersby)     [Orabug: 38847931] {CVE-2025-68818}
    - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847937]     {CVE-2025-68819}
    - ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848276]     {CVE-2025-68820}
    - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887597] {CVE-2025-71147}
    - usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852285]     {CVE-2025-71108}
    - via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852318]     {CVE-2025-71114}
    - ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847775] {CVE-2025-68783}
    - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847724]     {CVE-2025-68776}
    - net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847914] {CVE-2025-68816}
    - ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847826]     {CVE-2025-68795}
    - net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug:
    38847910] {CVE-2025-68815}
    - ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847900] {CVE-2025-68813}
    - netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38974757]     {CVE-2025-71146}
    - net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug:
    38847784] {CVE-2025-68785}
    - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi     Salim) [Orabug: 38847965] {CVE-2025-71066}
    - ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852333]     {CVE-2025-71118}
    - sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847753]     {CVE-2025-68780}
    - ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo) [Orabug: 38798767]     {CVE-2025-68346}
    - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug:
    38818237] {CVE-2025-68764}
    - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug:
    38798775] {CVE-2025-68349}
    - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug:
    38798787] {CVE-2025-68354}
    - ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798922]     {CVE-2025-68740}
    - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug:
    38798815] {CVE-2025-68362}
    - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818222]     {CVE-2025-68759}
    - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798824]     {CVE-2025-68364}
    - nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798833] {CVE-2025-68366}
    - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798838]     {CVE-2025-68367}
    - nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798851] {CVE-2025-68372}
    - spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798944] {CVE-2025-68746}
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug:
    38798875] {CVE-2025-68724}
    - drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818212]     {CVE-2025-68757}
    - gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798899] {CVE-2025-68732}
    - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K) [Orabug: 38773544]     {CVE-2025-68254}
    - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K) [Orabug: 38773554]     {CVE-2025-68255}
    - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug:
    38773587] {CVE-2025-68261}
    - ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773603]     {CVE-2025-68264}
    - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug:
    38792633] {CVE-2025-68337}
    - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina     Dubroca) [Orabug: 39004269] {CVE-2025-40256}
    - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334981,38932988]     {CVE-2025-38571}
    - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334968,38932991]     {CVE-2025-38566}
    - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730492,38933003] {CVE-2025-40215}
    - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783137]     {CVE-2025-68325}
    - fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847946] {CVE-2025-68821}
    - PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597010]     {CVE-2025-40034}
    - mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38420735,38773370] {CVE-2025-68209}
    - scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175026] {CVE-2025-38239}
    - RDMA/mlx5: Fix a WARN during dereg_mr for DM type (Yishai Hadas) [Orabug: 37766291,38463999]     {CVE-2025-21888}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
314498	MiracleLinux 8 : kernel-4.18.0-553.123.1.el8_10 (AXSA:2026-612:33)	Nessus	Miracle Linux Local Security Checks	high
314332	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50261)	Nessus	Oracle Linux Local Security Checks	high
313741	RHEL 10 : kernel (RHSA-2026:15883)	Nessus	Red Hat Local Security Checks	high
313522	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1681)	Nessus	Amazon Linux Local Security Checks	high
313511	Photon OS 5.0: Linux PHSA-2026-5.0-0834	Nessus	PhotonOS Local Security Checks	high
313507	Photon OS 5.0: Linux PHSA-2026-5.0-0842	Nessus	PhotonOS Local Security Checks	high
312840	RHEL 9 : kernel (RHSA-2026:14339)	Nessus	Red Hat Local Security Checks	high
312674	Oracle Linux 8 : kernel (ELSA-2026-13577)	Nessus	Oracle Linux Local Security Checks	high
312663	RHEL 9 : kernel (RHSA-2026:13932)	Nessus	Red Hat Local Security Checks	high
312656	RHEL 8 : kernel (RHSA-2026:14230)	Nessus	Red Hat Local Security Checks	high
312654	RHEL 9 : kernel-rt (RHSA-2026:14137)	Nessus	Red Hat Local Security Checks	high
312395	RHEL 9 : kernel (RHSA-2026:13936)	Nessus	Red Hat Local Security Checks	high
312380	RockyLinux 8 : kernel (RLSA-2026:13577)	Nessus	Rocky Linux Local Security Checks	high
312372	RockyLinux 8 : kernel-rt (RLSA-2026:13578)	Nessus	Rocky Linux Local Security Checks	high
312264	AlmaLinux 8 : kernel-rt (ALSA-2026:13578)	Nessus	Alma Linux Local Security Checks	high
312263	AlmaLinux 8 : kernel (ALSA-2026:13577)	Nessus	Alma Linux Local Security Checks	high
312152	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1646)	Nessus	Amazon Linux Local Security Checks	high
312110	RHEL 8 : kernel (RHSA-2026:13577)	Nessus	Red Hat Local Security Checks	high
312109	RHEL 8 : kernel-rt (RHSA-2026:13578)	Nessus	Red Hat Local Security Checks	high
311783	Debian dla-4561 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	high
311547	Debian dsa-6243 : affs-modules-6.1.0-44-4kc-malta-di - security update	Nessus	Debian Local Security Checks	high
311299	Debian dsa-6238 : ata-modules-6.12.74+deb13+1-armmp-di - security update	Nessus	Debian Local Security Checks	high
306779	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50232)	Nessus	Oracle Linux Local Security Checks	critical
304626	Linux Distros Unpatched Vulnerability : CVE-2026-23401	Nessus	Misc.	medium
304561	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50170)	Nessus	Oracle Linux Local Security Checks	high
304560	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50171)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2026-23401

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

medium

high

high